Combined Public Key (V8.0)

International Journal of Automation and Power Engineering (IJAPE) Volume 3 Issue 4 August 2014 DOI: 10.14355/ijape.2014.0304.01

www.ijape.org

Combined Public Key (V8.0) Xianghao Nan Orient Stec Institute of Information Technology Gaoliying, IAHP, Shunyi District, Beijing China Nanxh2001@163.com

Abstract: Combined Public Key (CPK) provides a common method to turn the existing public key into an identity-based public key.

CPK can solve the hard problem of large-scaled key management and identity authentication[1], and can solve the new problem of dealing with the quantum exhaustion attack.

Keywords Combined Public Key; CPK Crypto-system (CPK v8.0); Identity Authentication; Quantum Exhausting Attack

Introduction In modern public key systems, the public-key distribution has been a hard problem. In 1984, Shamir put forward for the first time if the identity can be taken as public-key, and constructed a public key system based on integer factoring problem, it has been the famous identity-based crypto scheme: IBC [2].

According to “truth logic”, an entity is composed of identity and body, and the “identity” means the unique name of an entity[3][4]. In 1989, the first identity-based pubic key system CPK-RSA is created in China and applied to the defense network, and released in 2003 by the topic of “multi-layered public key” [5]. CPK has been formed a big family, including CPK-RSA, CPK-DLP, CPK-ECC, CPK-CCC(conic curve)[6] and CPK-BLP(bi-linear pair), where in only CPK-ECC has the shortest signature code. Now we are going to take CPK-ECC as an example to illustrate the working procedure.

CPK-ECC is constructed on ECC over field Fp, E: y2 =x3 + ax + b mod p, the parameters are denoted as (a, b,G, n, p), in which a, b is coefficient, a,b,x,y∈Fp, p is prime, G is the base point of the addition group, n is the order of group generated by base point G [7][8]. Let an arbitrary integer r∈Fn be a private key. Then the point, rG=R, is the corresponding public key. The ECC has a compounding feature: the sum of public keys and the

sum of corresponding private keys are still the valid key pairs. For example, if the sum of private keys is: r = (r1 + r2 + ┄ + rm) mod n and the sum of corresponding public keys will be R = R1 + R2 + ┄ + Rm then (r, R) will be a new key pair. This is because R = R1 +R2 + ┄ +Rm = r1G+r2G+ ┄ +rmG = (r1 +r2 + ┄ +rm)G = rG. Combining-Matrix is divided into private matrix and public matrix, and is denoted as (ri,j) and (Ri,j) respectively, where r is random number less than n.

Matrix (ri,j) is kept secret only in KDC, and is used to produce private keys for individual entity. The public matrix (Ri,j) is derived from private matrix (ri,j) ri,j⋅G=Ri,j.

Public matrix is distributed to every entity and used to compute the public key of relying party.

Combined-Key Combined-key is derived from Combining-matrix A. the size of matrix is (32,32). The mapping from identity to the coordinates in the matrix is implemented through a Hash function under a certain Hkey.

The output is an integer string.

YS = HashHkey (ID) = w0, w1, … ,w35; The string of YS is divided into four groups of wi,j (i=0..3; j=1..8): w0,0..w0,8; w1,0..w1,8; w2,0..w2,8; w3,0..w3,8, where w0,0, w1,0, w2,0 and w3,0 is a 6-bit character used to determine the permutation disk(3-bit), and starting point(3-bit), and w0,1..w0,8, w1,1..w1,8, w2,1..w2,8, w3,1..w3,8, are 5-bit characters used to indicate the raw coordinate of matrix A. The column coordinates are transformed by permutation table. The table is sized by 8×8, and is encrypted and published in CPK chip. For an example, the given permutation table is 119

www.ijape.org

International Journal of Automation and Power Engineering (IJAPE) Volume 3 Issue 4 August 2014

SIGalice(h)=sign=(s, c)

Z Permutation Disk Table 0 12 3 4 5 6 7 [0] 7 4 2 3 5 1 6 7 [1] 4 6 3 5 0 7 2 3 [2] 6 0 7 6 4 3 7 5 [3] 1 2 6 1 7 0 5 6 [4] 2 7 0 2 3 5 1 0 [5] 0 1 3 7 6 2 4 4 [6] 5 3 1 0 2 4 3 2 [7] 3 5 5 4 1 6 0 1 Suppose that w1.0=(011001), then the permutation disk selected is 3, starting point is 1, the permutation will be Input h g f e d c b a Permutation Table

3 4 0 7 2 1 6 5

Output

f e b a g h d c

where alice is private key, h is an object to be signed, such as identity of entity, time of date or hash code of data, s is signing code, c is checking code.

Alice chooses a random number k (0<k<n) and computes kG = (x1, y1) c = (x1+y1)2 mod 2m s=k-1 {h + alice c} mod n Where 2m is used to select the length of checking code Alice sends {s, c} Bob verifies

0 7 6 5 4 3 2 1 the output is denoted as ti,j (i=0..3, j=1..8) The private key is generated in the KMC through the addition on finite field Fn. Alice’s private Combinedkey is 3

VERALICE(s)=c’ Bob calculates the public key according to identity: Alice→ALICE Bob verifies the signature according to sign=(s, c) s-1 h G + s-1 c ALICE = (x1’, y1’) c’ = (x1’+y1’)2 mod 2m

8

cskAlice = ∑ ∑ r[ wi , j ,ti , j ] .mod n =i 0=j 1

The public key is computed by relying party through point addition on elliptic curve E. Alice’s public Combined-key is 3

8

CPKAlice = ∑ ∑ R[ wi , j ,ti , j ] . =i 0=j 1

Keys for Private Network

If c= c’, the signature can be accepted.

Key Delivering Protocol CPK key delivery protocol is designed on the base of existing key exchanging protocols [10][11].

Suppose that Alice sends data to Bob. The encryption function is

CPK can be used either in a public network or in a private network.

ENCBOB(key)= β Ekey(data)=code

The key management center of public network is responsible for defining the parameters of public network

where ENC means encryption with asymmetric key, BOB is public key, r is a random number, E means encryption with symmetric key.

1. Defines the combining Matrix; 2. Defines hash key of Hkey; 3. Defines the permutation Table; The key management centers of private network are responsible for defining the parameter of private network for encryption only: 1. Defines a common key for private network; 2. Defines the role-keys for the users of the private network Digital Signature Protocol CPK signature protocol is established on the base of existing ECDSA[9]. The signing function is as follows.

120

Alice calculates Bob’s public Combined-key: Bob→BOB Alice selects a random number r, and calculates r·BOB=β r G=(x1, y1) key = (x1+y1)2 mod 264 Ekey (data) = code Alice sends {β , code} to Bob. The decryption function is DECbob(β)=key Dkey(code)=data

International Journal of Automation and Power Engineering (IJAPE) Volume 3 Issue 4 August 2014

Where DEC means decryption with asymmetric key, bob is private key, D means decryption with symmetric key.

Bob calculates β with his private key bob provided by ID-card bob-1 β = bob-1 (r BOB)= r G =(x1, y1) key = (x1+y1)2 mod 264 Dkey (code) = data Key Distribution Protocol There are two methods to distribute private keys. One is face-to-face distribution. The other is remote distribution via network. It is common to distribute in face-to-face when the user announces his/her identification and obtains the private key according to the given process. Remote distribution is used if the identity can be obtained or scanned such as the phone number on a SIM card or the account number on an IC card.

To implement remote distribution, we attach a UID for each CPK-chip. Each UID has a pair of public and private keys that will be used to establish the secret tunnel. Key Management Center (KMC) has a service center that is responsible for distributing private keys.

Private-key service center will publish its service phone number or its web site.

Process to Apply Private Key Application for private key includes the ID Alice, UID and the sign, which is to be sent to service web site or center.

Send: msg1:={UID, sign, Alice} Where sign is SIGuid(Alice)＝sign=(s, c) uid (lower case，italic) is the private key for UID. s is the signature code, c is the verification code, Alice is the identity for the application of private key.

Process to Distribute Private Key Web site or service center is to verify the authenticity of the ID of Alice: VERUID (s) =c’ If c=c’, then produce a private key. UID (upper case, italic) is the public key of UID. Send the private key alice that is encrypted by UID’s public key. For example:

www.ijape.org

Take a random number r, calculate: rG=key Ekey(alice)=code ENCUID(key)=β Send: msg2={code,β} where E is symmetric encryption and ENC is asymmetric encryption.

Process to Receive Private Key When msg2 arrives at user’s device, CPK system will automatically decrypt the private key: DECuid(β)=key Dkey(code)=alice Write the private key alice into chip based on the protection protocol of private key. DEC is asymmetric decryption and D is symmetric decryption.

Until now, the distribution is complete. The whole process is automated inside the CPK chip.

Security Analysis The security is related to three main aspects: the measure to deal with quantum exhaustion attack, the security of system keys and the security of individual keys.

The Measure to Deal with Quantum Exhaustion It will be effective for any exhaustion, only if there is a determinant. Otherwise it will be meaningless.

Firstly, it is needed to keep the private key and public key secret, and only the identity-based cryptosystem can keep the private key and public key secret at the same time. Making the public key open was the simplest way to solve the key distribution when a certain length of key can deal with the exhaustion of electronic computer. But when facing the quantum computer and once the public key is made open, the public key turns to be a determinant that enables the exhaustion of the private key. Take ECC as an example, in the equation of aG=A, a is private key, A is public key, G is the base point, where G is a known factor. If the public key A is open, then private key a can be exhausted, and there will be a unique solution. On the contrary, if the public key A is kept in secret, the exhaustion without determinant will be meaningless.

In the identity-based public key system, the identity stands for an entity, and is commonly known to public.

The open identity can offer the possibility to keep the

121

www.ijape.org

International Journal of Automation and Power Engineering (IJAPE) Volume 3 Issue 4 August 2014

public key in secret. So far, only identity-based systems can keep the public key in secret.

Secondly, it is needed to change the traditional public key system that is based on the computational complexity into a new type of public key system that is based on the linear complexity. The procedures of key generation and key distribution must be integrated and added by secret factors. The secret factors can enlarge the linear complexity “unlimitedly” and disable the exhaustion. All relying parties can calculate any public key without disclosing.

Thirdly, in the digital signature protocol and key delivery protocol, the private and public keys always appear in a form of inexhaustible equation. Take a simple equation (a b) mod 13=7 as an example, a and b are unknown. It is easy to understand that the equation has unlimited solutions and has nothing to do with exhaustion.

The Security of System Keys The linear relationship is the open problem of CPK Crypto-system, but: (1) It is hard to obtain the private keys. The private key may be protected by FLASH or EEPROM, and encrypted under a random key R1. So that It will be hard to read from outside, and will be disappeared automatically when someone attempts to anatomize the chip. Therefore, it is hard to collect a large amount of private keys.

(2) It is hard to describe the equations. The public matrix A and permutation table are protected by FLASH (and may be encrypted under Mkey). The mapping procedure is processed secretly under Hkey so that the linear equation cannot be described easily.

(3) It is hard to solve the equations. The work of counter-collusion can be done with our own motive.

For example, “false cards” including false private keys are distributed to some certain users. The “false card” will be used normally in the system, which will result in no solution for the equation.

If any one of above three links is accomplished, the system is secured.

The Security of Individual Keys The largest threats to individual keys will come from any kind of exhausting attacks. Once the public key is made open, the public key can be taken as a determinant in the exhaustion of private key.

122

Therefore, private key and public key must be kept in secret, i.e., the work with private key in signing and decrypting is done inside the chip, and the private key can never be exposed. In the same way, the work with public key in verifying and encrypting can be done inside the chip, and the public key can never be exposed. When the private key or public key are used in digital signature protocol or key delivery protocol, they must be in a form of compound number, and the equation must be inexhaustible.

1)

Individual Keys in the Signature Function

Hash code h is known factor, sign code s and verification code c are given factors in the process of signature function, where k G=(x1, y1) c= (x1+y1)2 mod 2m s = k-1 (h + c alice ) mod n

(1) (2) (3)

In item (2), there is only one unknown factor x1, and the exhaustion is meaningful. Let the key length n=192, verification code length m=40, then there will be 2192/240=2152 possible results that accord with c.

Furthermore, one can find 2152 possible k in item (1), and 2152 possible private key alice in item (3), therefore, the equation (3) is inexhaustible.

In addition, in this case (m=40), the probability of wrong judgment made in verification is only 1/240, but it will greatly shorten the length of signing code (shortened to 32 Byte from 48 Byte).

2)

Individual Keys in the Encryption Function

In the process of key delivery function, only the factors {β, code} are exposed, where r BOB = β r G = (x1, y1) key = (x1+y1)2 mod 264 Ekey (data) = code

(1) (2) (3) (4)

In item (1), β is a product of random number r and public key BOB. β = r BOB = r bob G = v G It is possible to find v from v G, and v is a product of random number r and private key alice. It will be hard to separate it from a random number r.

In item (4), the key can be exhausted if the decrypted data provides distinguishing base. Even in this case, the key still derives 2192/264=2128 possible x1. in item (2), one can find 2128 possible r. Back to item (1), although it reduces the number of possible

International Journal of Automation and Power Engineering (IJAPE) Volume 3 Issue 4 August 2014

r to 2128, it is still helpless to determine the private key bob or public key BOB. .

Summary CPK can integrate the key generation with key distribution and the theoretical scheme with practical engineering, and can greatly reduce the complexity of key management, and at the same time, it can turn the existing public key cryptosystem that is based on computational complexity into a new cryptosystem that is based on linear complexity. CPK is based on Identity, and when the identity used can generally be recognized, the corresponding public key can be kept in secret, and then a new asymmetric cryptosystem that can deal with any exhausting attack can be established.

CPK has a flexible structure, a large amount of variation and great potentialities, e.g., the amount of combination of Combing-matrix can reach 3232=1048, and one public network can hold 2128 private networks, and the number of user can be unlimited. CPK digital signature protocol can directly be used for identity authentication and entity authentication, and the key delivery protocol can directly be used in data encryption. Now it has broad applications in IP address authentication, telephone number authentication, bank account number authentication, software code authentication, the UID (of RFID tag) authentication [12], and so on.

www.ijape.org

ElGamal T, A Public key Cryptosystem and a Signature Scheme[J], IEEE Transactions on Information Theory, 1985, 31(4): 469-472 M. Brurros, M. Abadi, R, Needham, A logic of Authentication, ACM Trans, on Computer systems, 1990 Mingyuan Yu, Xian ping Huang, Li Jiang, Ronghua Liang, Combined Public Key Cryptosystem Based on Conic Curves over the Ring Zn, 2008 International Conference on Computer Science and Software Engineering National Institute of Standards and Technology, INST PUB 186, Digital Signature Standards, U.S. Department of Commerce 1994 Standard for Efficient Cryptography. SEC1: Elliptic Curve Cryptography 2000 Standard for Efficient Cryptography. SEC2: Elliptic Curve Cryptography 2000 The Whitehouse, Washington, NATIONAL STRATEGY FOR TRUSTED IDENTITIES IN CYBERSPACE, Enhancing Online Choice, Efficiency, Security, and Privacy, Apr. 2011 W. Diffie, M. E. Helman, New Direction of Cryptography [J].

IEEE Trans IT 1976, 22(6): 644-655 Xianghao Nan, CPK Crypto-system and Identity Authentication, Publishing House of Electronics and Industry, Sep.2012.

Xianghao Nan, Identity Authentication, Technical Basis of Cyber Security, Publishing House of Electronics and Industry,

REFERENCES

Jun. 2011

Adi Shamir, Identity-Based Cryptosystems and Signature

Xianghao Nan, Zhong Chen, A Profile to Network Security

Schemes [C], Advances in Cryptology, CRYPT 84, volume

Techniques, The publishing House of Defense Industry,

196 of LNCS, Springer-Verlag, 198447-53

Jul. 2003

123